Could not verify security on OpenSecureChannel request

[zlatinejc]

ISSUE

Cannot connect to remote UA sample server:
opc.tcp://srvtistk01.ourdomain.com:62547/Quickstarts/DataAccessServer

USING

dotnet run --project NetCoreConsoleClient.csproj -a opc.tcp://srvtistk01.ourdomain.com:62547/Quickstarts/DataAccessServer

SampleClient.Config.xml

<AutoAcceptUntrustedCertificates>true</AutoAcceptUntrustedCertificates>
<RejectSHA1SignedCertificates>false</RejectSHA1SignedCertificates> 
<MinimumCertificateKeySize>1024</MinimumCertificateKeySize>

PROBLEM

I am using the OPC UA DataAccessServer from the opcfoundation.org. The server url is running on localhost. Although I can connect to OPC UA GenericServer sample remotely I do not seem to posses the knowledge to configure the DataAccessServer to accept my client. Any help would be greatly appreciated.

DEBUG LOG:

Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.Private.CoreLib.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
Loaded '/Users/nejctrnjanin/projekti/OPCFoundation/UA-.NETStandard/SampleApplications/Samples/NetCoreConsoleClient/bin/Debug/netcoreapp2.0/NetCoreConsoleClient.dll'. Symbols loaded.
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.Runtime.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
Loaded '/Users/nejctrnjanin/.nuget/packages/mono.options/5.3.0.1/lib/netstandard1.3/Mono.Options.dll'. Module was built without symbols.
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.ObjectModel.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
Loaded '/Users/nejctrnjanin/projekti/OPCFoundation/UA-.NETStandard/SampleApplications/Samples/NetCoreConsoleClient/bin/Debug/netcoreapp2.0/Opc.Ua.Core.dll'. Symbols loaded.
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/netstandard.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.Console.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.Collections.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.Runtime.Extensions.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.IO.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
Step into: Stepping over non-user code 'NetCoreConsoleClient.Program.<>c__DisplayClass0_0..ctor'
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.IO.FileSystem.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.Runtime.InteropServices.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.Threading.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.Text.Encoding.Extensions.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
.Net Core OPC UA Console Client sample
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.Text.RegularExpressions.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
Loaded '/Users/nejctrnjanin/projekti/OPCFoundation/UA-.NETStandard/SampleApplications/Samples/NetCoreConsoleClient/bin/Debug/netcoreapp2.0/Opc.Ua.Client.dll'. Symbols loaded.
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.Threading.Tasks.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
Loaded '/Users/nejctrnjanin/projekti/OPCFoundation/UA-.NETStandard/SampleApplications/Samples/NetCoreConsoleClient/bin/Debug/netcoreapp2.0/Opc.Ua.Configuration.dll'. Symbols loaded.
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.Security.Cryptography.X509Certificates.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
Loaded '/Users/nejctrnjanin/.nuget/packages/system.servicemodel.primitives/4.3.0/lib/netstandard1.3/System.ServiceModel.Primitives.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
Loaded '/Users/nejctrnjanin/.nuget/packages/system.private.servicemodel/4.3.0/runtimes/unix/lib/netstandard1.3/System.Private.ServiceModel.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
1 - Create an Application Configuration.
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.Diagnostics.Debug.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
04/19/2018 10:24:40.462 Loading application configuration file. /Users/nejctrnjanin/projekti/OPCFoundation/UA-.NETStandard/SampleApplications/Samples/NetCoreConsoleClient/Opc.Ua.SampleClient.Config.xml
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.Runtime.Serialization.Xml.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.Private.DataContractSerialization.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.Xml.ReaderWriter.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.Private.Xml.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.Private.Uri.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.Runtime.Serialization.Primitives.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.Resources.ResourceManager.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.Linq.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.Reflection.Emit.ILGeneration.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.Reflection.Emit.Lightweight.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.Reflection.Primitives.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.Runtime.Serialization.Formatters.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.Diagnostics.Tools.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.Collections.NonGeneric.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.

************************* Logging started at 04/19/2018 10:24:40
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.Net.NameResolution.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.Diagnostics.Tracing.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.Security.Cryptography.Encoding.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.Runtime.Numerics.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.Collections.Concurrent.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.Security.Cryptography.Algorithms.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.Security.Cryptography.Primitives.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
04/19/2018 10:24:41.068 Checking application instance certificate.
04/19/2018 10:24:41.075 Checking application instance certificate. CN=UA Core Sample Client, C=US, S=Arizona, O=OPC Foundation, DC=nejcs-mbp
Loaded '/Users/nejctrnjanin/.nuget/packages/portable.bouncycastle/1.8.1.3/lib/netstandard2.0/BouncyCastle.Crypto.dll'.
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.Security.Cryptography.Csp.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
2 - Discover endpoints of opc.tcp://srvtistk01.smartis.si:62547/Quickstarts/DataAccessServer.
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.Net.Primitives.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.Threading.Timer.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
04/19/2018 10:24:41.602 Channel 0 in Connecting state.
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.Net.Sockets.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/Microsoft.Win32.Primitives.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.Threading.ThreadPool.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
04/19/2018 10:24:41.723 Channel 0: SendHelloMessage()
04/19/2018 10:24:41.755 Channel 0: ProcessAcknowledgeMessage()
04/19/2018 10:24:41.763 Channel 0 in Opening state.
04/19/2018 10:24:41.770 Token #0 created. CreatedAt = 08:24:41.769 . Lifetime = 3600000
04/19/2018 10:24:41.794 Channel 0: ProcessOpenSecureChannelResponse()
04/19/2018 10:24:41.805 Security Policy: http://opcfoundation.org/UA/SecurityPolicy#None
04/19/2018 10:24:41.811 Sender Certificate: (none)
04/19/2018 10:24:41.829 SECURE CHANNEL CREATED [.NetStandard ServerChannel UA-TCP 1.03.352UA-TCP 1.03.352] [ID=169] Connected To: opc.tcp://srvtistk01.smartis.si:62547/Quickstarts/DataAccessServer [None/None/Binary]
04/19/2018 10:24:41.835 Token #1 activated. CreatedAt = 08:24:41.769 . Lifetime = 3600000
04/19/2018 10:24:41.839 Channel 169 in Open state.
04/19/2018 10:24:41.873 Channel 169: Close
04/19/2018 10:24:41.877 Channel 169 in Closing state.
04/19/2018 10:24:41.883 Channel 169: SendCloseSecureChannelRequest()
04/19/2018 10:24:41.909 Channel 0 in Closed state.
04/19/2018 10:24:41.933 CLIENTCHANNEL SOCKET CLOSED: 005C39D4, ChannelId=169
Selected endpoint uses: Basic128Rsa15
3 - Create a session with OPC UA server.
04/19/2018 10:24:41.995 EXCEPTION BadCertificateUntrusted 'Certificate is not trusted.
SubjectName: CN=Quickstart Data Access Server, DC=srvtistk01
IssuerName: CN=Quickstart Data Access Server, DC=srvtistk01' Certificate is not trusted.
SubjectName: CN=Quickstart Data Access Server, DC=srvtistk01
IssuerName: CN=Quickstart Data Access Server, DC=srvtistk01
Exception thrown: 'Opc.Ua.ServiceResultException' in Opc.Ua.Core.dll
Exception thrown: 'System.AggregateException' in System.Private.CoreLib.dll
04/19/2018 10:24:42.595 Cert Validate failed: BadCertificateUntrusted
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.Diagnostics.StackTrace.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.Reflection.Metadata.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.Collections.Immutable.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
Loaded '/usr/local/share/dotnet/shared/Microsoft.NETCore.App/2.0.5/System.IO.MemoryMappedFiles.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
Accepted Certificate: CN=Quickstart Data Access Server, DC=srvtistk01
04/19/2018 10:24:42.698 Channel 0 in Connecting state.
04/19/2018 10:24:42.727 Channel 0: SendHelloMessage()
04/19/2018 10:24:42.743 Channel 0: ProcessAcknowledgeMessage()
04/19/2018 10:24:42.749 Channel 0 in Opening state.
04/19/2018 10:24:42.755 Token #0 created. CreatedAt = 08:24:42.755 . Lifetime = 3600000
04/19/2018 10:24:42.809 Channel 0: ProcessErrorMessage(BadSecurityChecksFailed 'Error received from remote host: Could not verify security on OpenSecureChannel request.')
04/19/2018 10:24:42.818 EXCEPTION BadSecurityChecksFailed 'Error received from remote host: Could not verify security on OpenSecureChannel request.'
Exception thrown: 'Opc.Ua.ServiceResultException' in Opc.Ua.Core.dll
04/19/2018 10:24:43.013 EXCEPTION BadSecurityChecksFailed 'Error establishing a connection: Error received from remote host: Could not verify security on OpenSecureChannel request.'
Exception thrown: 'Opc.Ua.ServiceResultException' in Opc.Ua.Core.dll
04/19/2018 10:24:43.223 Channel 0: Close
04/19/2018 10:24:43.231 Channel 0 in Closed state.
04/19/2018 10:24:43.236 CLIENTCHANNEL SOCKET CLOSED: 003A9F0C, ChannelId=0
Exception thrown: 'Opc.Ua.ServiceResultException' in Opc.Ua.Client.dll
Exception thrown: 'Opc.Ua.ServiceResultException' in System.Private.CoreLib.dll
Exception thrown: 'Opc.Ua.ServiceResultException' in System.Private.CoreLib.dll
Exception thrown: 'System.AggregateException' in System.Private.CoreLib.dll
04/19/2018 10:24:44.068 ServiceResultException:One or more errors occurred. (Error establishing a connection: Error received from remote host: Could not verify security on OpenSecureChannel request.)
Exception: One or more errors occurred. (Error establishing a connection: Error received from remote host: Could not verify security on OpenSecureChannel request.)
The program '[30224] NetCoreConsoleClient.dll' has exited with code 0 (0x0).

[markkuhar]

+1 I am facing the same issue.

[AlinMoldovean]

Hello @zlatinejc , @markkuhar ,

The connection seems to be rejected from the server side.
Are you attempting to connect on an endpoint with or without security?
The client certificate was copied in the trust list of the server?

[zlatinejc]

Hi!

The DataAccess client that I am using on the server machine (just for testing) lists some URLs among which I use the unsecured without security (at least I think so).

The Cert was copied, to the store via the UA Configuration manager. Is there a physical localtion I can check if it is actually there ?

Thank you for your help.

[AlinMoldovean]

@zlatinejc ,

The location of the trusted certificates should be in the configuration of the server.
That is the place where you need to copy the public key of the client.

[zlatinejc]

It seems that every time I try to establish a connection to the server my certificate move to RejectedCertificates folder:

C:\ProgramData\OPC Foundation\CertificateStores\RejectedCertificates\certs

Any ideas how to fix this ?

[zlatinejc]

I can see my certificate in the Certificate store:

Do I need to set up a trust list for the Discovery Server ?

[zlatinejc]

Solved:

Needed to import the cert to %CommonApplicationData%\OPC Foundation\CertificateStores\UA Applications store using the Import Certificate To Store...

It worked.

Thank you for your help.

[markkuhar]

Thank you very much!

[inmen]

application.ApplicationConfiguration.CertificateValidator.CertificateValidation += CertificateValidator_CertificateValidation;

private void CertificateValidator_CertificateValidation(CertificateValidator sender, CertificateValidationEventArgs e) { e.Accept = true; var store = new X509Store(StoreName.Root, StoreLocation.CurrentUser); store.Open(OpenFlags.ReadWrite); store.Add(e.Certificate); store.Close(); }